Privacy and Personal Data Processing Policy

1. General provisions

1.1. This Privacy and Personal Data Processing Policy (hereinafter — the Policy) has been developed pursuant to the requirements of part 2 of Article 4 of the Law of the Kyrgyz Republic “On Personal Information” and defines the legal and organisational grounds for the processing of personal data by LLC “Royal Group LTD” — ОсОО "Роял Групп ЛТД" (hereinafter — the Holder/Processor).

1.2. This Policy is aimed at ensuring the protection of the rights and freedoms of the data subject when processing their personal data and applies to all operations with personal data carried out by the Holder/Processor, whether performed by automated means or without them.

2. Rights and obligations of the parties

2.1. Data subjects have the right:

• to full information about their personal data processed by the Holder/Processor;
• to access their personal data, including the right to obtain a copy of any record containing their personal data, except in the cases provided for by the Law of the Kyrgyz Republic “On Personal Information”;
• to have their personal data updated, blocked or destroyed where the personal data are incomplete, outdated, inaccurate, unlawfully obtained or are not necessary for the declared purpose of processing;
• to take the measures provided for by law to protect their rights, including applying to the authorised state body for personal data;
• to exercise other rights provided for by the legislation of the Kyrgyz Republic.

2.2. Data subjects are obliged:

• to provide the Holder/Processor only with accurate data about themselves;
• to provide documents containing personal data to the extent necessary for the purpose of processing;
• to inform the Holder/Processor about any update (renewal, change) of their personal data.

2.3. The Holder/Processor has the right:

• to receive from the data subject accurate information and/or documents containing personal data;
• to clarify the personal data provided by the subject.
• to transfer the personal data of subjects to third parties where necessary

2.4. The Holder/Processor is obliged:

• to process personal data in the manner established by the Law of the Kyrgyz Republic “On Personal Information”;
• to consider requests from the data subject concerning the processing of personal data and to provide answers within a period not exceeding 7 days from the date the application is filed;
• to provide the data subject with the possibility of free-of-charge access to their personal data;
• to take measures to update personal data upon the request of the data subject;
• to organise the protection of personal data in accordance with the requirements of the legislation of the Kyrgyz Republic.

3. Scope and categories of the personal data processed

3.1. The Holder/Processor collects, uses and protects the personal data provided by the data subject during communication in any form, in accordance with this Policy and the legislation of the Kyrgyz Republic.

3.2. The Holder/Processor processes the personal data of the following data subjects: Surname, First name, Patronymic, Citizenship, Sex, Date of birth, Place of birth, PIN/TIN, Actual residence address, Telephone number, E-mail, Postal address, Education, Qualifications, Most recent place of work, Reference from the most recent place of work, Bank account, Certificates and licences, Medical information related to working conditions, Fingerprints, Voice data, Facial image, IP address, Device identifiers, Cookies and browser session data, Fingerprints, Voice data, Facial image, Social media profiles, Preferences, Interests, Purchase history, User behaviour on the website, Name of the organisation and details of its founders

3.3. The special categories of personal data processed by the Holder/Processor include:

• Ethnic origin
• Digital photograph
• Video recording
• Fingerprints

3.4. The Holder ensures that the content and scope of the personal data processed correspond to the declared purposes of processing and, where necessary, takes measures to eliminate their redundancy in relation to the declared purposes of processing.

3.5. The processing of special categories of personal data revealing racial or ethnic origin, ethnicity, political opinions, religious or philosophical beliefs, as well as data concerning health and sex life, is not carried out by the Holder/Processor / is carried out in strict accordance with Article 8 of the Law of the Kyrgyz Republic “On Personal Information”.

3.6. The lists of personal data and the categories of data subjects may be revised by the Holder, subject to mandatory recording of the changes in this Policy and notification of the data subjects by any available means (official website, announcement, push notification, sending a message to an e-mail address, etc.)

4. Purposes of collecting personal data

4.1. Personal data are processed by the Holder/Processor for the following predefined and lawful purposes:

• Granting access rights for the use of information systems
• Providing access to local information resources
• Providing advisory assistance
• Conclusion of an employment contract
• Conclusion, performance and termination of civil-law contracts
• Providing the User with access to the services, information and/or materials contained on the website
• Completion of an internship

5. Legal grounds for the processing of personal data

5.1. The legal grounds for the processing of personal data by the Holder/Processor are:

• the Labour Code of the Kyrgyz Republic;
• the Civil Code of the Kyrgyz Republic;
• the Law of the Kyrgyz Republic “On Personal Information”;
• the constituent documents of the Holder/Processor;
• contracts concluded between the Holder/Processor and data subjects;
• the consent of data subjects to the processing of personal data;

6. Procedure and conditions for the processing of personal data

6.1. The processing of personal data by the Holder/Processor is carried out by automated means.

6.2. The processing of personal data carried out by the Holder/Processor includes any operation or set of operations performed, regardless of the means used, by automated means or without them, for the purposes of collecting, recording, storing, updating, grouping, blocking, erasing and destroying personal data.

6.3. The processing of personal data is carried out by the Holder/Processor subject to obtaining the consent of the data subject (hereinafter — the Consent), except in the cases established by law where personal data may be processed without such Consent.

6.4. The means of notifying the data subject are: E-mail, Telephone call, SMS, Postal notifications, Official website, User’s personal account, Social networks, Push notifications, Interactive voice response (IVR)

6.5. The data subject decides to provide their personal data and gives such data in writing on paper or in the form of an electronic document, or through the registration interface in the application and on the website of the Holder/Processor.

6.6. Grounds for terminating the processing of personal data may include the achievement of the purposes of processing, the updating of personal data, and the detection of unlawful processing of personal data.

6.7. In order to achieve the purposes of processing, and where the consent of the data subject is available, the Holder/Processor has the right to transfer personal data to third parties provided that the recipient of the data is placed under an obligation to observe the confidentiality of such data.

6.8. When processing personal data, the Holder/Processor takes or ensures the taking of the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision and dissemination of personal data, as well as against other unlawful actions in respect of personal data.

6.9. Personal data must not be stored for longer than is necessary to fulfil the purposes of their collection. Storage periods may be extended only in the interests of the data subject or where this is provided for by the legislation of the Kyrgyz Republic.

7. Updating, correction, deletion and destruction of personal data, responses to data subjects’ requests for access to personal data

7.1. If the fact that personal data are inaccurate or that their processing is unlawful is confirmed, the personal data are subject to updating, blocking or destruction depending on the lawfulness of their collection, storage and processing by the Holder/Processor, or their processing must be terminated accordingly.

7.2. In respect of the inaccuracy of personal data or the unlawfulness of their processing, the data subject has the right to apply directly to the Holder or to the Authorised state body for personal data.

7.3. Upon the written request of the data subject, the Holder/Processor is obliged to communicate information about the processing of personal data carried out by it, reflecting the following information:

• confirmation of the fact of processing of personal data by the Holder/Processor;
• the legal grounds and purposes of the processing of personal data;
• the purposes and the methods of processing personal data applied by the Holder/Processor;
• the name and location of the Holder, information about persons (except for the Holder’s employees) who have access to the personal data or to whom the personal data may be transferred on the basis of a contract with the Holder of the personal data array or on the basis of law;
• the personal data being processed that relate to the respective data subject, and the source from which they were obtained;
• the periods of processing of personal data, including the periods of their storage;
• the procedure for the data subject to exercise their rights concerning the updating, blocking and destruction of personal data;
• information about a cross-border data transfer that has been carried out or is intended.

7.4. If the subject does not have access rights to the requested information, a reasoned refusal is sent to them.

7.5. Upon expiry of the storage period and achievement of the purposes of collecting personal data, they are subject to destruction within two weeks. The destruction is confirmed by a report, a copy of which may be handed to the data subject upon their written request.

8. Final provisions

8.1. All relations concerning the processing of personal data that are not reflected in this Policy are governed by the provisions of the Law of the Kyrgyz Republic “On Personal Information”.

8.2. The Holder/Processor has the right to make changes to this Policy. When changes are made, the current version indicates the date of the last update. The new version of the Policy enters into force from the moment it is made freely available for review, subject to the mandatory prior announcement of the planned changes at least 14 working days before the date of publication of the new version of the Policy.